Sign in

Get started

LegalData Processing PolicyHow VoyajeBoard processes personal data, including subprocessors, retention, international transfers, and regional addenda for GDPR, UK GDPR, CCPA, LGPD, and Quebec Law 25.

Privacy Policy

Cookie Policy

Contact

Who We Are

VoyajeBoard is operated by Voyajer Media LLC, an Illinois limited liability company. This Data Processing and Data Protection Policy explains how VoyajeBoard collects, uses, stores, shares, and protects personal data across the VoyajeBoard mobile app, the VoyajeBoard web app, the marketing surface at voyajeboard.com, and any related services.

Effective date: May 2026.

Postal address: Voyajer Media LLC, 1320 N. Wicker Park Ave, Chicago, IL 60622, USA.

Contact: support@voyajeboard.com.

Personal Data We Process

We process the data needed to run collaborative trip planning, account features, and the optional Plus subscription. We do not process IDFA, payment card numbers, phone contacts, health data, sensitive special-category data, or browsing history.

Account: email, display name, Appwrite user identifier.

Trip content: destinations, itinerary items, comments, reviews, photos, receipts, shared-budget records.

Diagnostics: aggregated screen views, taps, feature usage, crash logs, performance events (via Sentry and PostHog).

Subscription state: product id, renewal state, entitlement dates (via RevenueCat). The app stores handle payment card details, not VoyajeBoard.

Push tokens and notification preferences, only after you grant the OS-level permission.

Lawful Bases

Where required, we rely on one or more lawful bases under GDPR Article 6 (and the equivalent in other regimes).

Performance of a contract: account features, trip storage, collaboration, subscription management.

Legitimate interests: product analytics, safety, fraud prevention, affiliate-click measurement, service improvement.

Consent: notifications, optional analytics where required, marketing communications.

Legal obligation: tax, regulatory, and law-enforcement requirements.

Subprocessors

We share personal data with a curated set of subprocessors only as needed to operate the Service. The current list is summarized below. Voyaje for Business customers receive a separately maintained subprocessor list in their organization agreement.

Infrastructure and storage: Appwrite (database, auth, storage), Render (server hosting).

Analytics and diagnostics: Sentry (crash and performance), PostHog (product analytics).

AI: OpenAI (primary AI provider), Gemini (Google Cloud, receipt scanning and fallback).

Travel data: TripAdvisor, Viator, Booking.com, Skyscanner, GetYourGuide, Amadeus, AeroDataBox, Federal Reserve H.10, Open-Meteo, WeatherAPI.com, Unsplash, Google Places, Google Cloud Translation.

Subscription and payments: RevenueCat, Apple App Store, Google Play.

Email: Postmark (transactional email).

Retention

We keep personal data only as long as needed for the purposes in this policy, unless a longer period is required for legal, safety, fraud-prevention, backup, or dispute-resolution reasons.

Account, profile, settings, trips, media, and shared-budget data: kept while the account or related trip is active, deleted or de-identified after deletion, with backups retained up to 90 days.

Affiliate clicks, partner impressions, analytics events, product interaction data: up to 24 months, then deleted, de-identified, or aggregated.

Crash, performance, and diagnostics data: up to 12 months unless needed longer for security, reliability, legal, or abuse investigations.

Support, safety, legal, and abuse records: up to 3 years or longer when required.

International Transfers

VoyajeBoard and its subprocessors may process data in the United States and other countries. Where required by law, we rely on Standard Contractual Clauses (EU SCCs), the UK International Data Transfer Addendum, or other approved safeguards. OpenAI API traffic should be configured for United States processing where available, and prompt content is minimized before being sent to any AI provider.

You can request a copy of the transfer safeguards relevant to your personal data by emailing support@voyajeboard.com.

Affiliate Click Tracking

When you tap a booking link, we record the click for analytics. The destination partner may receive an attribution parameter that identifies VoyajeBoard as the referrer. They do not receive your personal information.

Partner websites and apps may collect information from you if you continue with them, create an account, make a booking, or contact their support team.

Your Rights

Depending on where you live, you may have rights related to access, correction, deletion, restriction, portability, objection, withdrawal of consent, and complaints to a regulator. Section 14 below summarizes the regional addenda.

Use in-app controls for profile visibility, blocked users, notification preferences, data export requests, deletion requests, and account deletion.

Contact support@voyajeboard.com for privacy requests or complaints.

Children under 13 are not permitted to use VoyajeBoard. Users confirm they are 13 or older during registration.

Breach Notification

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where the risk is high, will notify affected users without undue delay.

Regional Addenda

The following regional summaries supplement the primary policy above for residents of the listed jurisdictions. Where a regional rule conflicts with the primary policy, the regional rule controls.

European Union and EEA (GDPR): Controller is Voyajer Media LLC, at the address above. Rights under GDPR Articles 15 through 22 are honored. The right to lodge a complaint with your national supervisory authority is preserved. Article 27 EU Representative will be appointed before any campaign that specifically targets EU data subjects; interim contact is support@voyajeboard.com.

United Kingdom (UK GDPR): same rights and timelines as the GDPR addendum, interpreted under UK law. Supervisory authority is the ICO. UK Article 27 Representative will be appointed before any UK-targeted campaign; interim contact is support@voyajeboard.com.

California (CCPA and CPRA): we do not sell personal information for monetary consideration. We share limited identifiers and click attribution with affiliate partners for cross-context behavioral advertising; you can opt out in Settings or via Global Privacy Control signals. Verifiable consumer requests are answered within 45 days.

Brazil (LGPD): VoyajeBoard is Controller of consumer personal data. Rights under LGPD Article 18 are honored. The data protection authority is the ANPD.

Quebec (Law 25): the responsible person for personal information protection is reachable at support@voyajeboard.com. VoyajeBoard has elected not to publicly name an individual under Section 3.1 of the Act; written requests are routed internally to the responsible person.

Governance Roles

VoyajeBoard's processing activities do not require a Data Protection Officer under GDPR Article 37: we are not a public authority, our core activities are not large-scale systematic monitoring of data subjects, and we do not process special categories of personal data at scale. EU and UK Article 27 Representatives will be appointed before any campaign that specifically targets data subjects in those regions and will be listed here when active.

All data-protection inquiries: support@voyajeboard.com.

Postal address: Voyajer Media LLC, 1320 N. Wicker Park Ave, Chicago, IL 60622, USA.

Changes To This Policy

We may update this policy from time to time. Material changes will be announced through an in-app notice, a banner on voyajeboard.com, or an email to the address associated with your account.